Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.
Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key.
Verify that the application terminates all active sessions when a user account is disabled or deleted (such as an employee leaving the company).
Verify that the application terminates all active sessions when a user account is disabled or deleted (such as an employee leaving the company).
Verify that the application gives the option to terminate all other active sessions after a successful change or removal of any authentication factor (including password change via reset or recovery and, if present, an MFA settings update).
Verify that the application gives the option to terminate all other active sessions after a successful change or removal of any authentication factor (including password change via reset or recovery and, if present, an MFA settings update).
Verify that all pages that require authentication have easy and visible access to logout functionality.
Verify that all pages that require authentication have easy and visible access to logout functionality.
Verify that application administrators are able to terminate active sessions for an individual user or for all users.
Verify that application administrators are able to terminate active sessions for an individual user or for all users.